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VOLUME I: Technical Consultation Report 
1.0 Authorization and Notification 

Bryan O'Connor, Office of Safety and Mission Assurance (OS&MA), requested that the NESC 
provide a materials expert to evaluate two differing risk assessments regarding the start and 
propogation of cracks associated with thick film coatings on electronic packages (E -packages) on 
the Delta II Launch Vehicle. 

Mr. Ralph Roe, Director of the NESC, initiated the request for consultation on December 23, 
2004. 

The NESC approved the white paper at the NESC Review Board (NRB) on January 6, 2005. 
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4.0 Executive Summary 

The Deep Impact spacecraft was launched on a Boeing Delta II rocket from Cape Canaveral Air 
Force Station (CCAFS) on January 12, 2005. Prior to the launch, the Director of the OS&MA, 
Mr. Bryan O’Connor, requested the NESC to lead a team to render an independent opinion on 
the rationale for flight and the risk code assignments for the hazard of cracked Thick Film 
Assemblies (TFAs) in the E-packages of the Delta II launch vehicle for the Deep Impact 
Mission. The concern was with the possibility of cracks and crack growth in the TFA in the 
servo-control electrical packages on the Delta II launch vehicle. This issue surfaced during the 
System Mission Assurance Readiness Review (SMARR). The KSC Launch Services Program 
(LSP) and the Boeing Launch Services Contractor (LSC) presented this item as no risk, and 
Kennedy Space Center (KSC) Safety and Mission Assurance (S&MA) presented it as a medium 
residual risk item. 

The NESC team concluded that the KSC S&MA, Boeing and the LSP all agreed on the nature 
and cause of the TFA cracking hazard, and on the existing rationale for flight. However, they 
used different rationales in assigning risk codes when using a common assessment tool. The 
NESC team concluded that the TFA crack risk should be considered to be in the range of 
medium-to-low risk, and represented an acceptable risk for flight. The NESC team concurred 
with KSC S&MA that “5x2” more accurately characterized this risk. Boeing and the LSP 
acknowledged the probability of failure to be “less than 1 percent”, but not zero, as assessed by 
their subjective methods. KSC’s S&MA and the NESC team agreed that the TFA cracking 
hazard represented a reportable risk for the Flight Readiness Review (FRR). The possible cause, 
excessive conformal coating under the TFA assemblies due to manufacturing changes, was 
identified, but was not verified by testing. An enhanced component-level screening test, which 
reviewed parametric data from box-level testing while looking for changes, has proven effective 
to-date. However, there is some risk that this technique may not be 100 percent effective 
because it is an indirect method of detection. Due to the potential for undetected micro-cracks to 
propagate with time or with the launch environment, a residual risk remained to trigger failure of 
an assembly with micro-cracks that are under stress. 

The NESC team concluded that Boeing and the LSP should continue to pursue other design 
approaches to further reduce the risk to TFA circuits in the future. 
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Figure 4.0-1. Deep Impact lifts off from pad 17-B at Cape Canaveral Air Force Station, 

Florida January 12, 2005 

(NASA photo) 
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5.0 Consultation Plan 

The NESC approved the white paper at the NRB on January 6, 2005. The mission of this effort 
was to investigate the possibility of cracks and crack growth in the TFA in the servo-control 
electrical packages on the Delta vehicle. After evaluation of the risks by the KSC assessment 
team and Boeing, it was realized that the means for rating risks varied between the organizations, 
making it difficult to confirm a rating assignment for the FRR. 
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6.0 Description of the Problem, Proposed Solutions, and Risk Assessment 

6.1 Mission Background 

The Deep Impact mission is a partnership with the University of Maryland (UMD), the 
California Institute of Technology's (CIT) Jet Propulsion Laboratory (JPL), and Ball Aerospace 
and Technology Corporation (BATC). The scientific leadership of the mission is based at UMD. 
Engineers at BATC designed and built the spacecraft under JPL's management. Engineers at 
JPL control the spacecraft after launch and send data to scientists for analysis. The mission is 
implemented with a two-part spacecraft. The larger "flyby" spacecraft carries a smaller 
"impactor" spacecraft to the comet Tempel 1, and releases it into the comet's path for a planned 
collision. 

In January 2005, a Delta II rocket (configuration shown in Figure 6.1-1) launched the combined 
Deep Impact spacecraft which, after leaving Earth's orbit, was directed toward the comet. The 
combined spacecraft approached the comet and collected images before the impact. In early July 
2005, 24 hours before impact, the flyby spacecraft pointed high-precision tracking telescopes at 
the comet and released the impactor on a course to hit the comet's sunlit side. 

After release of the impactor, the flyby spacecraft maneuvered to a new path that, at closest 
approach, passed 500 kilometers (km) (300 miles) from the comet. The flyby spacecraft 
observed and recorded the impact data, the ejected material blasted from the crater, and the 
structure and composition of the crater's interior. After its shields protected it from the comet's 
dust tail passing overhead, the flyby spacecraft turned to re-look at the comet. The flyby 
spacecraft took additional data from the other side of the nucleus and observed changes in the 
comet's activity. While the flyby spacecraft and impactor performed, professional and amateur 
astronomers at large, and small telescopes on Earth, observed the impact and its aftermath. 
Results were broadcast over the Internet. 
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Vehicle Configuration 


■ Vehicle configuration: 7925-9.5 

■ Launch site: SLC-17B at CCAFS 

' Launch period: 30 Dec 2004 - 28 Jan 2005 
1 Unique mission requirements: 

• 3712C payload attach fitting 

• Third stage motor dome blanket 
(with metal Velcro) 

• Nutation control system 

(37 Ibf reaction engine assembly) 

• De-spin system 

• Third-stage ballast (10 ± 10 lb) 

• 2 mission-specific access doors 

• Two 37-pin PAF umbilicals 


Fairing 



Deep Impact 
Spacecraft 


Second Stage 


Thrust 

Augmentation ' 


Solids 




ittach Fitting 
NCS System 
Third-Stage Motor 

\ Separation Clamp Band 
pin 


pin Table 

guidance Electronics 
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and Support Truss 
Helium Spheres 
i— Nitrogen 
nterstage 
Wiring Tunnel 
Fuel Tank 
enterbody Section 


Oxidizer Tank 



Fairing 
onical Section 


airing Access Door 


Figure 6.1-1. Deep Impact Launch Configuration 


6.2 Technical Issue Description 

At the S&MA FRR, the issue of electronic package (E-package) cracked TFAs was assessed by 
the KSC S&MA organization as a “5x2” residual risk. Note that the Boeing and the LSP did not 
list this item as a reportable risk. The issue involved a number of E-packages that contained 
TFAs that were manufactured at an El Paso, Texas facility following a supplier change from 
Monrovia, California (this supplier change resulted in process changes). Cracks were found in 
some TFAs in El Paso during 2002. An enhanced screening technique was put in place to 
perform an enhanced review of box-level acceptance test data to look for parametric changes of 
greater than 5 percent as an indicator of possible TFA cracks. Appendix C shows the formula 
and the plot of DeltaR/R versus Crack Size 1 . This issue also was previously addressed for the 
Swift and Messenger missions’ launch vehicles. Two of these potentially “suspect” E-packages, 
containing a total of twelve TFAs, were used in the Deep Impact Launch Vehicle: one E-package 


1 Extraction from Henning Leidecker’s Cutbar Essay. 
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with one circuit board with two TFAs in the first stage, and one E-package with two circuit cards 
with a total of eight TFAs in the second stage. These E-packages are part of the vehicle’s 
guidance navigation & control (GNC) system. TFA failure during launch can be catastrophic. 

The chart from the S&MA FRR is shown in Figure 6.2.- 1, which summarizes their assessment of 
the issue. 


E-Package Cracked Thick Film Assemblies 


Mission Success 

N/A 

N/A 

Technical 

Safety and Mission Assurance 

Raoul Caimi, KSC 

SA-G 


RISK TYPE: 

HAZARD REPORT: 

CRITICALITY: 

RISK CATEGORY: 

ORGANIZATION: 

ASSIGNED TO: 

INDEPENDENT ASSESSORS: 

RISK DESCRIPTION. X: SMA Risk Assessment 

A cracked TFA has been detected in a first stage E-pkg at the HY1 location. This is the first such departure from the HY3 location for 
this issue, as seen previously. The existing enhanced screening technique’s ability to detect the presence of such a crack was 
evaluated for applicability to the first stage E-pkg. This screen has been previously used for 2 nd stage E-pkgs on MESSENGER and 
Swift. Both primary and secondary circuits can be affected by a TFA crack leading to loss of mission. 


MISSION SUCCESS RISKS 



CAUSE: 

Not determined. Boeing is attributing the cracks to conformal coating shrinkage during cure. 

RISK EFFECTS: 

Loss of mission. 

RISK REDUCTION ACTIONS: 

An enhanced screening technique has been developed to detect TFA cracks for second stage E-pkg's. Boeing and LSP used the 
same technique to detect TFA cracks in first stage E-pkg’s. The Deep Impact 1 st stage E-pkg passed the screening with no indication 
of a cracked TFA. 

CONSTRAINTS TO FLIGHT: 

None. 

RECOMMENDATION / RATIONALE: 

The screening technique detects the presence of existing detrimental cracks; therefore, this presents a risk that can be accepted for 
flight. 


Figure 6.2-1. TFA KSC S&MA Risk Chart 


6.2.1 Causal Factors 

The TFAs contain circuit traces (conductors) on an alumina substrate, as well as surface- 
mounted electronics parts. Some of these parts include high precision resistors that are bias and 
gain setting elements for op-amps in servo amplifier circuits. Boeing hypothesized that the new 
process changes introduced the possibility of excess conformal coating material between the 
TFA modules and the polyamide printed circuit card to which they are mounted and connected. 
As the conformal coating material cures and shrinks, Boeing suggested that stresses can be 
induced in the alumina TFA module and can result in cracks. 
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Following the initial discovery of the problem in 2002, an “enhanced screening” technique was 
instituted where the box-level acceptance test data was reviewed for parameter changes, or 
deltas, between the initial Acceptance Test Procedure (ATP) and subsequent ATPs. A threshold 
for investigation was set to be a parametric change of 5 percent or greater from one ATP to 
another. The enhanced screening was a manual review of the detailed parametric data collected 
during the ATP. Cracks in the TFAs were detected by failures which propagated into parts on 
the boards, most notably high stability precision laser-trimmed resistors that set amplifier gain or 
biasing. These cracks manifested themselves in observed parametric shifts in the data during the 
detailed box ATP testing. Absence of parameter shifts between initial and final acceptance 
testing is considered to be evidence that an E-package that does not contain cracks of concern. 
These box-level ATPs were run between 201 and 500 days after the cards were originally 
conformal-coated. It was possible for the boxes to pass original go/no-go functional testing, but 
still have parametric shifts. 


The basis for flight or flight rationale is the understanding of the likely root cause of the failures, 
and passing the box-level enhanced parametric data screening. The residual risks are that there is 
less than 100 percent certainty that the true root cause has been identified and there are 
reasonable questions as to the effectiveness of the screening. 

6.3 NESC Risk Assessment 

The risk assessment process included the identification of hazards, assessment of hazard 
consequences, assessment of likelihood of hazard occurrence, and flight rationale and acceptance 
of the assessed risk. The differences of opinion between the KSC S&MA organization and the 
Boeing and the LSP were due to subjective assessments based on engineering experience, 
differences in optional approaches for the application of assessment tools, and translation 
between limited reliability data and system failure probability. 

The overall risk assessment performed by KSC S&MA is shown in Figure 6.3-1. The TFA crack 
issue was assessed as a medium residual risk item. 


NESC Request No. 04-093-E 



NASA Engineering and Safety Center 
Technical Consultation Report 

Document #: 

RP-05-126 

Version: 

1.0 

Title: 

Deep Impact Delta II Launch Vehicle Cracked Thick 
Film Coating on Electronic Packages Technical 
Consultation Report 

Page #: 

14 of 41 


Assurance Elements 
S = Safety 

M = Mission Success 

Program 

KSC SMA 

Minority Opinion 

SMA 1- Thick Film Assembly 


M 


SMA 2- GEM Delaminations 


M 


SMA 3- Microsemi Transistor 


M 


SMA 4- RIFCA Alignment 


M 



SAFETY RISKS 



CONSEQUENCES 



Figure 6.3-1. KSC S&MA Deep Impact Residual Risk Assessment Summary 

The LSP and the launch vehicle manufacturer used a risk assessment matrix as shown in Figures 
6.3-2 and 6.3-3. An assessment of probability of an issue causing failure within 100 flights was 
made based on the judgment of program engineering. 
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Risk Definitions - Probability 


Probability Classification 


Very Low 


Guidance for 
Probability 
Level 
Selection 


*1-5% 


Probability of 
occurrence is very 
low. Existing 
processes and 
mitigation efforts 
are strong and 
very likely to 
prevent this risk 


6 - 10 % 


Probability of 
occurrence is 
low. Existing 
processes and 
mitigation 
efforts are 
usually 
sufficient to 
prevent this risk 
scenario; 
additional 
actions may be 
required. 


Moderate 


11-50% 


Probability of 
occurrence is 
moderate. 
Existing 
processes and 
mitigation 
efforts may 
prevent this risk 
scenario, but 
additional 
actions will be 
required. 



51-90% 


Probability of 
occurrence is 
high. Existing 
processes and 
mitigation 
efforts cannot 
prevent this risk 
scenario; a 
different 
process or 
mitigation effort 
might. 


91 -<100% 


Probability of 
occurrence is 
very high. 
Existing 
processes and 
mitigation 
efforts cannot 
prevent this 
risk scenario; 
no alternative 
processes or 
mitigation 
efforts are 
available. 


‘Percentages are for comparative purposes only. 

SMA does not use percentages shown 

Source: Launch Services Program Risk Management Plan (KSC-PLN-2130) 


Figure 6.3-2. LSP Risk Definitions 
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Risk Definitions 



Impact 

Source: Launch Services Program Risk Management Plan (KSC-PLN-2130) 
SMA does not use the percentages shown 


Figure 6.3-3. LSP Risk Definition Matrix 


Risk Discussion 

Until recent times, the tenn "risk" was equated with "hazard, danger, peril, exposure to loss, 
injury, or destruction". There was no sense that likelihood of this event actually happening was 
part of the term "risk". "Risk" only meant a possibility of incurring loss or misfortune, and did 
not address whether this possibility was likely or unlikely. "Risk" was a one-dimensional term. 

Only in the last few decades has "risk" become two-dimensional. The subject of "risk 
management" supposes that we can both quantify the loss associated with a "risk event", and also 
quantify the likelihood of this "risk event". A failure effects analysis is designed to help with the 
first quantification, and some sort of probability analysis is designed to help with the second. 
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A large practical problem, however, is that resources were never spent to collect the data needed 
to make a reliable probability analysis for some "risk events", especially for rare events that 
infrequently happen and happen in expensive systems. Therefore, in many cases, these 
probability evaluations were made as a guess. In particular, this is the case for the various 
probability evaluations for the cracking of sintered alumina TFA, used in the GNC system of the 
Delta II chosen for the Deep Impact launch. 

Boeing has offered an explanation for these cracks: the choice of confonnal coating material and 
the manner of its application has caused stresses that have risen to the level of the fracture 
strength of the sintered alumina. Thus, some have cracked. This explanation is plausible; 
however, it has not been established with rigor. For example, it does not address the role played 
by cracks in the surface of these alumina plates (induced by handling and by the laser cuts used 
to trim the resistors on the surfaces of these plates). These surface cuts are not likely to be "all 
the same" as one moves from specimen to specimen. No fractrography seems to have been 
conducted to identify the source of each crack, especially for the ones that have completely 
shattered the alumina plates. The fraction of the cracked specimens has not been reproduced in 
any way by Boeing's explanation. 

It may be possible to regard these alumina plates as having been subject to a "proof test" by the 
pre-flight tests. This provides confidence that those alumina plates, that have survived so far, 
will not fail during the much less stressful launching conditions. However, Boeing has not 
presented this "proof test" argument in an orderly manner, using the standards now established in 
areas of fracture mechanics, which report quantitative studies of the effectiveness of different 
"proof test" designs for particular systems. 

Thus, the probability of success "P" is not rigorously known. The value of P or its uncertainty 
limits, "P minimum, P maximum", are not kn own in an objective manner. A reliable value for 
this P is not known, although it can be supposed it is more likely to be "low" (less than 10 
percent) than "high" (greater than 10 percent), and even more likely to be "very low" (less than 1 
percent) than simply low. 

The risk matrix used by US programs follows our legal system does not allow "not kn own" as a 
measure of the probability of failure. It compels one to choose a category. In response to this 
constraint, it is the policy of some organizations to assign "high risk" to the cases when one 
cannot objectively assign a probability value. This has happened in this circumstance where the 
KSC S&MA team has reacted to the uncertainty in the value of P with the finding that "this 
likelihood is appreciable": level two. Level two is also assigned to be consistent with the KSC 
S&MA’s experience base for large number of evaluations. 
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Boeing has reported that their engineers were surveyed with the question: "Based on your 
experience, and supposing one hundred launches, what is the number of launches that would fail 
as a result of using control systems like the ones considered for this Deep Impact launch?" The 
response was that this was judged to be less than one launch failure per one hundred launches. 

So, Boeing has concluded that the estimate of the probability of launch failure caused by a crack- 
induced fault in a TFA is less than 1 percent. This falls below the threshold at which Boeing 
reports risks. Boeing judged this risk to be "below the chart’s lower edge". However, they did 
not mention whether their engineers agreed to the "less than 1 percent"; whether there were those 
who supposed a larger value, and only the average of all these estimates was below 1 percent; or 
whether there were some who declined to make any estimate. These all point to a possible lack 
of consistency with these engineering estimates. 

This discussion explains how the Boeing and the KSC S&MA teams have provided different 
reports as to launch risk: their policies are different and non-comparable. The elasticity of the 
tenn "probability", presently used on risk charts, extends to include these extremely different 
uses: engineering guesses on the part of Boeing versus an attempt to communicate uncertainty on 
the part of the KSC's S&MA team. Boeing's choice of "don't report if P < 1 percent" has an 
implication that is troubling. Most likely there are many hundreds of subsystems like the TFAs 
of interest. Assume this number as N. Suppose that each has a problem that presents a 
probability for launch failure of "f" that is just under 1 percent, so the probability of success is p 
= 1 - f = 99- percent. For the launch to succeed, each of these N subsystems has to work; the 
probability of a successful launch is then P = p**N. The table below illustrates values for launch 
success "P" for various levels of N : 


N 

P 

10 

90 percent 

30 

74 percent 

100 

37 percent 

300 

4.9 percent 


Thus, Boeing could be non-reporting a collection of problems, each falling below their " 1 
percent" criteria, which could still dramatically lower the probability of a successful launch. The 
only way for a complicated system to be reliable is for each of its subsystems to be remarkably 
reliable. As soon as subsystems are accepted that are less than remarkably reliable, launch 
failures will occur. 

Thus, this investigation surfaces some differences in policy between assigning values to the 
"likelihood of failure", as used by the Boeing and S&MA teams. It also surfaces a reporting 
policy ("<1 percent" = do not report) on the part of Boeing that can have an ominous 
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consequence for systems as complex as a launch vehicle. Is there a way to arrive at a better 
estimate for the probability of failure caused by a crack in a TFA affecting its performance 
during launch, given the pre-testing that these units have had? Perhaps further exploring the 
"proof testing" approach may provide a more objective quantitative basis. 
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7.0 Data Analysis 

7.1 Detailed Technical Discussion 

To assess the performance of the Delta second stage TFA, it is important to understand the 
fracture properties of the sintered alumina (AI2O3) TFA coating. The alumina coating exhibits 
brittle fracture characteristics typical of most ceramic materials. This is evidenced by the classic 
brittle fracture shown in Figure 7.1-1. The following sections briefly describe the typical 
fracture properties expected for the TFA coating exposed to tensile load. In general, tensile stress 
rather than compressive stress promote cracking in these materials. Single crystal AI2O3 
(sapphire) data is used to approximate the general fracture properties of the TFA. (The single 
crystal data is used here to establish likely trends and not absolute properties). 
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Note: Cracks exhibit brittle “glass-like ’’fractures. (Reference: NASA Presentation: “Cracked 
Thick Film Assemblies, Delta II, Stage 2 Servo Amplifier CCA EBR-02043, contributions 
by Thomas Bulk et al) 

7.1.1 Assessment of Material Properties 

For the TFAs, the stress has been applied by bending the specimen. This means that the largest 
stresses are, at the surface, on the outside of the imposed bend (i.e., the side that is stretched as 
the film bends), and so surface cracks on this surface are of dominating importance. (For 
practical purposes, the internal defects associated with voids left from incomplete densification 
during sintering can be ignored). These dominating surface cracks are not defined by knowing 
that this material is "sintered alumina", but rather on the handling that the specimen has been 
given. 

For example, sintered alumina plates do not have intrinsic fracture strength by the time they have 
reached service. Rather, the largest bending stress that they can sustain is entirely controlled by 
the presence of surface cracks installed by the handling they receive up until failing. This 
handling causes a distribution of cracks of various sizes "a". The largest of these, in a high-stress 
region, will dominate the observed fracture strength. 

It has long been known that glass tubes that have been handled (even by letting one tube touch 
another) have their resistance to breaking when bent sharply reduced. This strength can be 
restored essentially back to its "as new" value by polishing the surface (either by the use of 
rouge, by "fire polishing," or by etching in hydrofluoric acid). This illustrates that brittle 
materials do not have an intrinsic strength in the field, after handling, but have a strength against 
bending stresses that is entirely determined by the surface cracks installed by handling. 

One common way for a sintered alumina plate to acquire a highly damaging nick is for another 
plate to brush against it. Contact with hardened steel (such as a file or a scribe) is another way to 
scratch the surface of the alumina. Placing the sintered alumina plate onto some hard surface can 
induce edge-cracks. 

If the edges of these sintered plates are not chamfered, but are left in the form of right-angles, 
then edge-chipping is inevitable as the plates are handled. Typically, it may be taken for granted 
that any bit of optical glass such as a mirror, a window, or a lens will be chamfered. Flowever, in 
E-Packaging applications, substrates of sintered alumina are typically not chamfered. Usually, 
these are hard-bonded to a strong backing and not subject to bending. But these TFAs are 
subject to bending stresses, and so they should be edge-chamfered. One of the pictures of the 
shattered plates seems to show that the cracks started from edges. The laser-induced cuts used to 
trim the TFA resistors are classic "cracks" into the surface of the alumina. Some researchers 
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studying the fracture properties of alumina have taken to using laser-cuts as an especially 
controlled way of inducing a well-defined crack into the surface of the alumina. 

It seems unlikely that each of the sintered alumina specimens comprising the substrate of these 
TFAs would have the same handling-induced damage. Therefore, it would seem that the family 
of them would show great variability in the time to fracture (one hundred to one variations are 
easy to understand), even when subject to the same applied stress. 

It is possible that the population of edge-cracks, and perhaps cracks on the surface away from the 
edges, play a role in the fracturing of the TFAs. This is important in understanding which plates 
fractured and which ones did not. A positive note is that the rate of crack growth, under applied 
stress, increases as rapidly as the applied stress is increased that "proof testing" can work if the 
specimen has passed a given load without fracture. Then, it is highly unlikely it will 
subsequently fracture under a substantially smaller load. Additional study of "C" and "p" for 
sintered alumina and these relationships (as described in the “Fracture Properties” section below) 
may be able to show a quantitative model of the degree to which the Boeing tests have acted as a 
"proof test". This would give quantitative support to Boeing's position that all the plates that are 
ever going to crack under launch loads have already been forced to crack by pre-launch stresses. 
This approach may be useful for future flights. 


Alumina Processing 

AFO 3 can be prepared as equi-axial crystals of a moderately uniform diameter and can be 
sintered into a solid by exerting pressure at a high temperature. The result is a material with a 
density approaching that of the single crystal fonn (and thus one parameter characterizing this 
sintered form is its density, while another is the grain diameter). A typical value is 98 percent 
used as an E-Packaging substrate (sometimes the value can be up to 99.8 percent). 

Fracture Properties 

The fracture mechanics of the sintered form is the subject many publications. Used as a 
packaging substrate, as it is in the TFAs of present interest, sintered alumina shows "brittle 
fracture". When subjected to an increasing stress, its strain increases linearly up to a certain 
threshold of stress and then the specimen shatters. There is no region of ductile deformation in 
which the sample plastically deforms. Hence, the critical stress that separates "safe" linear 
deformation from "catastrophic" rupture must be understood. 

Many studies show that the sintered alumina is suffused with cracks. One class of these is the 
micro-cracks surrounding internal voids left from incomplete densification during sintering. 
Another class is surface cracks of all sizes — from atomic dimensions (always) to as large as 
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visible (sometimes) — resulting from the formation and the handling of the specimen. Purely 
compressive stresses force all cracks to close. Alumina is remarkably strong under purely 
compressive stresses. 

Tensile stresses force all cracks, internal as well as surface cracks, to grow. The rate of growth is 
increased by the presence of catalytic agents such as water (present in the environment as 
moisture in the air, which is concentrated by surface tension at the tip of a crack into essentially 
liquid densities). One useful relation is crack growth rate = da/dt = C K p where "a" is the length 
of the crack, "t" is the time, "K" is the stress factor, "C" is a pre-factor, and " p " is an exponent. 

For some alumina specimens, values of “ p ” as large as 60 have been measured. The value of "C" 
for silica glass is roughly 10 5 times larger in the presence of moist air than in an excellent 
vacuum. However, water has a much smaller effect on "C" for sintered alumina. The relation 
between the stress factor "K" and the applied stress is controlled by the crack length and shape 
and its orientation to the applied stress. This relation is defined in texts on fracture mechanics. 

Crack Growth Properties 

The TFA alumina will likely exhibit typical ceramic tensile properties such as high modulus, 
low total ductility, and low fracture toughness. These result in brittle crack growth and fracture. 
Typically, resistance to sustained load cracking is poor. Initially, stable crack growth rapidly 
becomes unstable and leads to fracture at relatively low tensile loads (low crack-tip stress 
intensity threshold - Kth = 1-5 MPaVm) for single crystal alumina (sapphire) in humid air (shown 
in Figure 7.1-2). As shown, the near vertical slope of the "crack growth rate versus crack-tip 
stress intensity" curve is typical of the spectacular crack growth characteristics of these 
materials, which make them potentially dangerous in high-stress applications that can be ruined 
by cracking. 

A small change in crack-tip driving force (tensile stress) results in a dramatic increase in crack 
growth rate until unstable crack growth and final fracture occurs and fracture toughness is 
rapidly reached (Kic~2. 1 MPavm). Similar brittle crack growth characteristics are observed 
under cyclic loading, also shown in Figure 7.1-2. These data illustrate that the TFA coating 
material is “crack sensitive”, which means that small flaws (micro-cracks) can readily propagate 
under tensile loading. 

7.1.2 Environmental Crack Growth Properties 

Alumina is susceptible to environmental-assisted cracking under sustained load, stress corrosion 
cracking (SCC) and cyclic loading, and corrosion fatigue (CF). Figures 7.1-2 and 7.1-3 show the 
SCC characteristics of sapphire exposed to different levels of relative humidity air and Ringers 
solution (NaCl, Na lactate, KC1, CaCl). Figure 7.1-2 also shows that what are commonly 
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thought to be relatively benign environments (50 percent relative humidity (RH) air) can increase 
crack growth rates in sapphire. These data show that time-dependent environmental crack 
growth damage modes can occur in AI2O3 materials and should be considered when cracking is 
possible. Figure 7.1-4 shows that under fatigue loading, a dramatic change in environmental 
crack growth characteristics is observed. Also depicted, a factor of 10 increased fatigue crack 
growth rates is observed for the Ringers solution compared to humid air. Again, these data show 
that the environment can have deleterious effects on the crack growth rates of these materials. 


7.1.3 Assessment of Cracked TFA Thick Coating 

Given the brittle fracture properties of the TFA, it is likely that the rigorous ATP testing screened 
most damage. The “crack sensitivity” and rapid crack growth characteristic of these materials 
would likely produce failure during the ATP testing. Whether undetected damage was produced 
remains a valid point of discussion. 


10 4 


? 10 1 

1 

5 

3 

3 \ 

2 10 7 ■ 


10 4 


0 10* 

jic 

1 

O 


10 ' 


Ringer's 

Solution 

37°C 



r 


a 

n 

n 

0 

a 


4 

i 


1 


K 


TH 


i 


Humid Air 
24*C 


K 


ic 


Applied Stress Intensity. K (MPa Vm) 

Figure 7.1-2. Crack Velocity Curve for Sapphire in both Moist Air and Ringer’s Solution 
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Figure 7.1-3. Crack Velocity Curves for Sapphire Exposed to Air showing Increased Crack 

Growth Velocity with Increased RH 
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Applied Stress Intensity Range. SK (MPa ✓m) 

Figure 7.1-4. Comparison of the Environmental Fatigue Crack Growth Characteristics of 
Sapphire in Moist Air and Ringer’s Solution (NaCl, Na lactate, KC1, CaCl) 

The technical information, sent by the LSP to the team for review, includes pictures of two 
shattered TFAs (Figure 7.1-1) taken after removing the TFAs from their circuit cards. The 
pictures show completely disconnected shards of alumina. It seems impossible that traces 
crossing these fracture lines could have remained intact during all the stresses applied to them 
while these alumina substrates were still mounted to the circuit card. There should have been no 
problem detecting these cracks. 

Other pictures of still-mounted TFAs show almost invisible "hair line" cracks that extend for a 
limited distance along the alumina, and not all the way across a TFA. These partial cracks seem 
to have the potential to partly separate a conducting trace, but not to separate it completely. The 
resistance of the partially separated trace would increase somewhat, but not to essentially an 
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open circuit. Boeing's "enhanced" detection method is aimed (in part) at detecting the partially 
cracked traces. The completely open cracked trace should be easily detected. The other aim of 
the "enhanced" method is to detect if any TFA resistors that have been "clipped" by a crack were 
altered, but not opened electrically. 

A quantitative computation of the increase in resistance caused by a "cut" normal to the edge of a 
trace extending partway through it, shows that the increase in resistance remains essentially 
invisible until the cut is almost complete, more than 90 percent through. In cases in which there 
is "in-line" resistance from an interposed resistive element, the crack would have to extend more 
than 99+ percent through in order to be detectable as an increase in resistance by more than 5 
percent. 

The reason that the increase in trace resistance caused by a partial cut is so hard to detect is that 
the increase comes from a disturbance in the flow of the electrical current that is limited to the 
immediate neighborhood of the cut (i.e., over a length about equal to the width of the trace), 
while the total resistance comes from the entire length of the trace, and the ratio of the width to 
the total length is small. Also, in this application, the trace-resistance is not measured by itself in 
isolation, but is summed with in-line resistors, which makes trace resistance increases even more 
difficult to detect. 

Even the "enhanced" detection method, employed by Boeing to detect cracks that partially cross 
a trace, will be insensitive to partial cuts. Such a method will see almost complete cuts only. 

The Boeing "enhanced" detection scheme may or may not see cracks that pass through part of a 
film resistor. The visibility of such "clipping cuts" requires a different analysis. 

Detecting cracks in ceramics is a problem that has been around since the start of NASA’s use of 
ceramics. One of the more powerful methods is to use "vicinal illumination 2 ", granted the 
alumina is translucent and not dark or black, and the optical inspection is possible. 

Unfortunately, it is too late (without massive impact) to inspect the assemblies mounted in the 
Delta II about to be launched. It is safe to assume that there will be further use of sintered 
alumina in E-packaging, and the use of this inspection method may be helpful in the future. 

Figure 7.1-5 shows an image at ~50X of a slab of alumina with a pair of cracks making a V- 
shape. The illuminator was arranged to put a bright spot onto one side of the crack-pair. It is 
evident that the light did not cross the crack-boundaries, making these especially visible. These 
cracks were not visible in normal top-down illumination. 


" The vicinal illumination technique has been successfully used to detect cracks in many types of ceramic materials. 
This inspection method has become an important tool for inspection and analysis of many ceramic materials for 
space flight applications. 
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Figure 7.1-6 is the same image, but mildly enhanced to better show the crack. This image is the 
ratio of Figure 7.1-5 to an image of precisely the same spot when used to illuminate a featureless 
region of the ceramic. These two figures illustrate how powerful this non-destructive inspection 
method is. 
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10 

Figure 7.1-5. Pair of Cracks at ~50X of a Slab of Alumina (V-shaped Cracks) 
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Figure 7.1-6. Ratio of Figure 7.1-5: Closer View of Crack Image 
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8.0 Findings, Observations, and Recommendations 

Team findings and recommendations from this assessment are listed below. 

8.1 Findings 

F-l. A cracked TFA was detected in a Delta II first stage E-package, which had been built 
with "non-suspect" TFA. 

F-2. The Deep Impact launch vehicle has three E-packages of potential concern, one in the 
first stage and two in the second stage. The first stage E-package was manufactured in 
Monrovia, and, to date, none of these units have been found to experience cracks. The 
second stage E-packages went through ATP five times, with the enhanced screening 
applied. They were most recently tested in July 2004. 

F-3. The TFA crack risk should be considered to be in the range of medium-to-low risk, and 
represents an acceptable risk for flight. The NESC team concurred with KSC’s S&MA 
that “5x2” more accurately characterizes this risk. 

Rationale (F-l through F-3): 

• Although the comprehensive review conducted by Boeing indicated that thick 
film cracking occurred as a result of manufacturing processing, and ATP testing 
and analysis indicated that crack propagation, which could lead to faulty TFA 
performance during flight, is unlikely, there is a finite probability that marginally 
cracked TFAs could have passed existing ATP testing criterion. 

• The LSP acknowledges the probability of failure to be “less than 1 percent”, but 
not zero, as assessed by their subjective methods. 

• The likely root cause - excessive conformal coating under the TFA assemblies 
due to manufacturing changes - has been postulated, but has not been verified by 
testing. 

• Enhanced screening test, which reviews parametric data from box level testing 
looking for changes, has proven effective to-date, but may not be 100 percent 
effective because it is an indirect method of detection. 
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• Because of the potential for undetected micro-cracks to propagate with time or 
from the launch environment, a residual risk remains for undetected micro-cracks 
to trigger failure of an assembly under stress. 

• KSC S&MA and the NESC team agree that the TFA cracking hazard represents a 
reportable risk for FRR. 

F-4. KSC S&MA, Boeing and the LSP agreed on the nature and cause of the TFA cracking 
hazard, and on the existing rationale for flight. However, when using a common 
assessment tool, they used different rationale in assigning risk codes. 

Rationale (F-4): 

• The LSP Risk Management Plan (KSC-PLN-2 130) defines the risk probability 
code levels (1-5) with both verbal labels and/or numerical percent probability 
ranges. 

• KSC S&MA, Boeing and the LSP all seek to maintain internal consistency in 
their risk assessments, for continuity of reporting and internal risk management. 

• KSC S&MA does not use the percentages as guidance for code assignment, 
relying more on the verbal and subjective guidance provided in the Plan. 

• Boeing uses a subjective assessment of numerical probability as their guide to risk 
probability assignment, as provided in the LSP Risk Management Plan. 

• KSC S&MA, Boeing and the LSP apply subjective engineering judgments in 
assessing risk and assigning risk codes, as sufficient data is seldom available. 

F-5. The flight environmental loads are lower than the box ATP loads. 

Rationale (F-5): 

• Thermal cycle test margin is a minimum of +39° F. 

• Shock test margin is greater than 15 dB. 

• Random Vibration test margin is 5.2 dB minimum. 

8.2 Recommendations 

R-l. The Director of the OS&MA should direct the Deep Impact FRR process to continue 
with the acceptance of flight rationale for the TFA cracking issue with the acceptable 
risk, assessed as “5x2”. 
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Rationale R-l: 

• Two boxes with potentially suspect TFAs have been identified: one in the first 
stage and one in the second stage. Both have passed the enhanced parametric 
screening. 

• The first stage box (20142) was produced in Monrovia. No cracked TFAs have 
been found in Monrovia- assembled units. 

• The second stage box (20166), even though assembled in El Paso, passed the 
enhanced screening with five data sets reviewed, the most recent being July 2004. 

• Flight environmental loads are far less than the box-level ATP loads than the units 
passed successfully. 

R-2. The Director of KSC S&MA should initiate a review of the LSP Risk Management Plan 
(KSC-PLN-2130) to clarify the guidance for probability level (percent) selections, and 
make application of the tool more uniform. 

R-3. Boeing should continue to pursue other design approaches to further enhance robustness 
and minimize the likelihood of this type of failure in TFA circuits. Areas recommended 
include thicker substrates, chamfered edges, handling improvements to preclude the early 
development of micro-cracks, proof testing, and vicinal illumination inspection. 

R-4. For future missions, the Boeing and the LSP should: 

• Determine whether enhanced test(s) can be run on the vehicle, which would add 
confidence without removing the boxes. 

• Perform box-level testing and detailed data screening review of all boxes 
containing TFA, preferably within one year of launch, to guard against the 
possibility of micro-crack growth. 

• Monitor the E-packs during environmental testing to detect electrical intermittent 
conditions that may indicate a crack. 

• Consider the Destructive Physical Analysis (DP A) of an E-pack, which has 
passed the enhanced screening in 2002 but is from the “suspect” units, to 
determine whether there are signs of cracking with time. 
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9.0 Lessons Learned 


1. The only way for a complicated system such as a launch vehicle to be reliable is for each 
of its individual subsystems to be remarkably reliable. When subsystems that are less 
than reliable are accepted, failures will occur. 

2. Effective risk management requires that risks be categorized and communicated with a 
common understanding. Improved methods at consistency in accurately assessing risk 
will enhance safety and mission success. 

10.0 Definition of Terms 

Corrective Actions Changes to design processes, work instructions, workmanship practices, 
training, inspections, tests, procedures, specifications, drawings, tools, 
equipment, facilities, resources, or material that result in preventing, 
minimizing, or limiting the potential for recurrence of a problem. 

Finding A conclusion based on facts established during the assessment/inspection 

by the investigating authority. 

Lessons Learned Knowledge or understanding gained by experience. The experience may 

be positive, as in a successful test or mission, or negative, as in a mishap 
or failure. A lesson must be significant in that it has real or assumed 
impact on operations; valid in that it is factually and technically correct; 
and applicable in that it identifies a specific design, process, or decision 
that reduces or limits the potential for failures and mishaps, or reinforces a 
positive result. 


Observation A factor, event, or circumstance identified during the 

assessment/inspection that did not contribute to the problem, but if left 
uncorrected has the potential to cause a mishap, injury, or increase the 
severity should a mishap occur. 


Problem 


The subject of the independent technical assessment/inspection. 


Recommendation An action identified by the assessment/inspection team to correct a root 

cause or deficiency identified during the investigation. The 
recommendations may be used by the responsible C/P/P/O in the 
preparation of a corrective action plan. 
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Root Cause Along a chain of events leading to a mishap or close call, the first causal 

action or failure to act that could have been controlled systemically either 
by policy/practice/procedure or individual adherence to 
policy/practice/procedure. 

11.0 Minority Report 

There were no minority opinions voiced during the performance of this consultation. 
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NASA Engineering and Safety Center 
Request Form 

Submit this 1TA/I Request, with associated artifacts attached, to: nrbexeCSeC@nasa.gOV . or to 
NRB Executive Secretary. M'S 105. NASA Langley Research Center, Hampton. VA 23681 

Section I: NESC Review Hoard (XKH) Executive Secretary Record of Receipt 

Received (mm/dd/yyyy hanrn am/pm) I Status: New I Reference 04-093-E 

12/22/2004 4:40 PM' ' | 

Initiator Name: Bry an O'Connor E-mail: Center: HQ 

bryan.oconnor@nasa.gov | 

Short Title: Cracked Thick Film Coatings on Electronic Packages on the Delta 2 Launch 
Vehicle 

Description: Bryan O'Connor requested that the NESC provide a materials expert to evaluate two differing risk 
assessments regarding the start and propogation of cracks associated with thick film coatings on electronic 
packages on the Delta 2 I -lunch Vehicle. A ERR is scheduled for the 8 th of January 8 and Bryon O'Connor 

would like a second opinion to brief the AA with before that if date. 

Source (e.g. email, phone call, posted on web): 
e-mail 

Type of Request: Consultation 

Proposed Need Date: 

Date forwarded to Systems Engineering Office (SEP): (mm/dd/yyyy h:ntm am pm): 

Section 2: Systems Office St rct'/un^ 

Section 2.1 Potential IT A/I Identification 

Received by SEP: (mm/dd/yyyy h:mm am/pm): 12/23/2004 1 2:00 AM 
Potential IT A/I candidat e? [>\lYe s I I No 

Assign ed Initial Evaluator (I E): No initial evaluation. This was a pprov ed Out of Board 

Date assi gned (mm/dd/yyyy): 

Due date for ITA I Screening (mm dd yyyy): 

Section 2.2 Non 1I A/I Action 

Requires additional NESC action (non-lT A/I)? [Xl Vcs | 1 No 
If yes: 

Description of action: Consultation 
Actionee: Ken Cameron 12/23/2005 

Is follow-up required? fXl Yes I I No If yes: Due Date: 01/06/2005 

Follow-up status/date: Schedule at 6 Jan 2005 NRB to present report recommendations 

If no: 

NESC Director Concurrence (si gnature) : 
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Section 3: Initial Evaluation 

Received by IE: (mm/dd vvyy h:mm am/pm): 

Screening complete date: 

Valid IT A/I candidate? I I Yes 1 I No 
Initial Evaluation Report #: NESC-PN- 
Target NRB Review Date: 

Section 4: XKH Review anil Disposition ofSCE Response Report 

[TAT Approved: EH Yes I I No ; Dale Approved: Priority: - Select - 

ITA/I U-ad: , Phone ( ) - , x 

Section 5: IT A/I Lead Planning. Conduct, and Reporting 

Plan Development Start Date: 

I TA/I Plan # NESC-PL- 
Plan Approval Date: 

IT A 'I Start Date ] Planned: ] Actual: 

ITA/I Completed Date: 

ITA/I Fin al Repo rt #: N ESC-PN- 

ITA I Briefing Package U\ NESC-PN- 

Section 6: Follow-up 

Date Findings Briefed to Customer: 

Follow-up Accepted: I I Yes I I No 

Follow-up Completed Dale: 

Section 7: Disposition and Notification 

Notification type: - Select - Details: 

Date of Notification: 

Final Disposition: - Select - 

Rationale for Disposition: 

Close Out Review Date: 
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Form Approval and Document Revision History 


Approved: 


NESC Director 

Date 


Version 

Description of Revision 

Office of Primary 
Responsibility 

Effective 

Date 

1.0 

Initial Release 

Principal Engineers 
Office 

29 Jan 04 
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Appendix C. Cutbar Essay 

On the increase in resistance caused by a crack. This is from page 5-24 of the 
American Institute of Physics Handbook, published by McGraw-Hill in 1963 (second edition). 

Consider a bar with a rectangular cross section; its lengt h is (, its thickness is t and its width 
is w. The resistivity of the bar is p and its resistance is 

tw 

Make a cut into the bar across its width, extending a distance c, so the current is restricted 
to flow through the gap w - c in the immediate neighborhood of the cut. The increase in 
resistance caused by the cut is 


Afl = -©' "[«*©]' 

this is a relative increase of 

ln b©] • 

The factor <1 >(c/tt>) = — ln[cos(jrc/2u>)| is shown in the figure. (Note that <t> > 0. since the 
cos-term is always less than unity and, thus, the logarithm is always negative.) 

The usual case for a wire is that the length ( is many times the width tr. and so the relative 
increase is very small indeed. Consider a wire that is one foot long and has a square cross 
section with w = 0.05 inches (close to #18); then, (4w)/(ir() = 0.0053. An increase in the 
resistance by 1% requires <l> - 1.88, or c/w = 0.903. That is, the cut must extend to 90.3% 
of the width in order to increase the resistance of this choice of wire by 1%. 


(2) 

(3) 



Figure 1: 4>(c/w) versus (c/w) 
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Appendix D. List of Acronyms 


AI 2 O 3 

aluminum tri-oxide 

ATP 

Acceptance Test Procedure 

BATC 

Ball Aerospace and Technology Corporation 

CaCl 

Calcium Chloride 

CCAFS 

Cape Canaveral Air Force Station 

CF 

Corrosion Fatigue 

CIT 

California Institute of Technology 

DPA 

Destructive Physical Analysis 

FRR 

Flight Readiness Review 

GNC 

Guidance Navigation & Control 

GSFC 

Goddard Space Flight Center 

h 2 o 

Water 

IT A/I 

Independent Technical Assessment/Inspection 

JPL 

Jet Propulsion Laboratory 

JSC 

Johnson Space Center 

KC1 

Potassium Chloride 

Km 

kilometers 

KSC 

Kennedy Space Center 

LaRC 

Langley Research Center 

LSC 

Launch Services Contractor 

LSP 

Launch Services Program 

NaCl 

Sodium Chloride 

NASA 

National Aeronautics and Space Administration 

NCE 

NESC Chief Engineer 

NDE 

NESC Discipline Expert 

NESC 

NASA Engineering and Safety Center 

NRB 

NESC Review Board 

OS&MA 

Office of Safety and Mission Assurance 

RH 

Relative Flumidity 

S&MA 

Safety and Mission Assurance 

see 

Stress Corrosion Cracking 

SLC 

Space Launch Complex 

SMARR 

System Mission Assurance Readiness Review 

SSP 

Space Shuttle Program 

TFA 

Thick Film Assembly 

UMD 

University of Maryland 
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